Fireside Chat with Jen Buckner

Good morning, good afternoon, everybody. Uh, this is Mike Ungar. I am one of the co-founders of the Industry 4.0 Club, and this is our weekly fireside chat. Our Industry 4.0 Club, we host rooms Monday through Thursday. Um, Monday we focus on women in manufacturing, Tuesday is the future of manufacturing, Wednesdays are fireside chat, and Thursday is people, process, and culture. I'm really fortunate today to be joined by our guest, Jen Buckner, and our co-host, Carol Mitchell-Linn. Carol, you want to introduce yourself just quickly if you don't mind?

Yes, thanks, Mike. Thanks very much, Jennifer, for being with us today. I'm Carol Mitchell-Linn, an Industry 4.0 Club co-founder, and I'm a co-host of the Women in Manufacturing Room on Mondays. And when I'm not helping out with the Industry 4.0 Club, I'm a content marketing specialist with Raven AI.

Thanks, Carol. And so, again, our special guest today is Jen Buckner. We're really excited to have the conversation with her. Jen is currently the Senior Vice President for Technology Risk Management for Mastercard. She serves on several corporate boards, and she's a retired Brigadier General from the U.S. Army. So, Jen, thank you for your service. She's also a 1990 graduate of the United States Military Academy. So, Jen, we're really glad that you could join us today. So I wanted just to ask you some personal questions to get started. So why did you choose West Point?

Thanks, Mike. I chose West Point for very pragmatic reasons. I'm a native of Downers Grove, Illinois, and I wanted to go to school out of state. And, you know, Illinois has such— has fantastic universities, but I was really interested in going to an Ivy League school, and West Point was free and what I could afford. So very pragmatic. But of course, and I went there not knowing anything about the Army, having no family military service connections. But as many do, you know, I ended up staying for 20, and then 30 years, surprisingly. So, and I think that's— I'm going to come back to that at the end for some career advice because, you know, be careful what you plan for because the— you know, I stayed because of the people and the opportunities. So what an inspired choice that I didn't fully appreciate that I was making at the age of 17.

Well, thank you for that. You know, for our listeners, many of them aren't aware that you're actually in the Army Sports Hall of Fame. And were a backstroker and won the NCAA 200-yard backstroke in 1990. So I know that's probably a fond memory for you. So you branched to military intelligence. Why did you choose MI at the time?

Remember in the 1980s, you know, that this was the— in 1989 when we were commissioning, it was the Berlin Wall, the fall of the Berlin Wall. And so it was, you know, this really interesting time of change post— the beginning of the post-Cold War era. And so intelligence was just fascinating to me, both from a geopolitical and strategic view, from a technical view. As a mechanical engineer, I liked the technical sophistication that many intelligence capabilities offered and the chance to work with linguists and strategists and things like that. So it just seems really wide open from that perspective. And so it was the logical choice to take my passion for strategy and combine it with some of the technology aspects.

So, look, that's great. Looking back at your career, you mentioned almost 30 years. Can you— do you have one or two experiences that you'd share with our audience that you would say are really formative for you in that time that you were in the military?

Yeah, I think I'd start with not only the selection of intelligence, but also the selection of my first post, which was the 82nd Airborne Division in Fort Bragg. At the time, the premier unit in the Army. And of course, I would want to go there if given the opportunity. I got a lot of advice at that time that we were about 10 years into integrating women in West Point. still early days in the integration of women or adding more women to the Army. And so I will— I got a lot of advice not to go there because there weren't many women there yet. And it turned out to be really bad advice. But probably my timing was also great as well. And so I joined the 82nd Airborne Division. And I would say that it was— there were a lot of similar feelings to that of being on a sports team. Being on the swim team, I was a part of a platoon, a company, a division that felt like a winning team. And you wanted to be a part of that winning team, whatever the mission. And so that being a good team member and being a part of the 82nd and not wanting to let my teammates down was such a great continuity from what I did, from what I learned growing up through sports and through West Point. But it's also indicative, I think, even today, you know, fundamentally, I want to be a good teammate. I want to, you know, be on the winning team and I want to contribute to that. So that was the— in fact, I loved the 82nd so much I went back for a second tour. So that was certainly really important. The second career inflection point, if I could, you know, was the— Was the— was my service in Iraq as a battalion commander leading a multifunction intelligence battalion at Fort Hood and getting ready for— to deploy. This was really interesting because at the time it was right when the new SOFA agreement was put into place. And so we went there thinking we were going to be in combat and we ended up having to implement a strategy that made Iraqis be in the lead. It was a partnership model. So fundamentally different from what we trained for. But of course, all the training that we did as a team allowed us to pivot really quickly, which I found is something that I do also in business now. And then finally, I had the opportunity after redeploying from Iraq— I actually considered leaving the Army at that time. But someone, actually Keith Alexander, former director of the National Security Agency and US Cyber Command, said, would you consider doing something? We have this thing called cyber. And come up and help us grow Cyber Command. And I wasn't sure what I wanted to do when I got out, so I took a chance. But obviously, relationships that you have with folks you work with in the military are so important. And I trusted him. And that led to another 10 years. And now my career pivot into cybersecurity. So I'm so grateful for, you know, that, that opportunity. But certainly it was because we had worked together. And so the importance of, you know, network and mentoring, and I'm so grateful.

Well, thanks. Those are some really interesting experiences. It's— I guess all of us think back on our careers to significant things that have happened. And it's really great to hear those pivot points for you. So thanks for sharing that. So I kind of want to then move forward and talk more now about cybersecurity, because that's obviously what a lot of our listeners are interested in and would love to hear and learn more about from you. So, you know, Mastercard— Mastercard has quite a sophisticated approach to cybersecurity, probably one of the most sophisticated ones in the world, I would guess, just given the mission that Mastercard has. What are some of the key elements that you see to maintaining a secure network and really having a top cybersecurity approach?

Well, I would start with, of course, my opportunity post-Army with Mastercard in cybersecurity is actually because of a network connection. And the Chief Security Officer of Mastercard is Ron Green. He is my West Point classmate. And, you know, he had Army service, he had Secret Service. And so the idea that, you know, Mastercard really has a much greater commitment, not only providing payment services, but also their understanding of protecting our critical financial infrastructure and payment systems around the world. So this commitment to greater good, and today he leads the Financial Services Sector Coordinating Council, that's indicative, I think, of the company's commitment to not only doing what's right for our customers, but also what's right for consumers in the US and globally. You know, in terms of advice, so I lead the governance, security governance and standards. And I think a disciplined approach to ensuring that you understand security standards and how you are meeting those standards, not just from a compliance or regulatory model, but really understanding how you deliver on security is one of the first things. And, you know, you have to have someone who I think is on, you know, in the lead, whether it's a chief information security officer or someone on your staff who really owns that security and has a direct line to, you know, company leadership, because you want that person to push and to do the right thing. It can't be security at the expense of business. It has to be a balance of both. And there are sometimes often, you know, decisions that have to be made, um, and an understanding of the risk. Um, you know, the perfect security solution may not be feasible, um, from a financial or business perspective. So understanding that gap and the risk there, I think, for an informed view on security risk, um, I think is important. Um, and then I would, you know, I would also offer, um, a multidiscipline team, um, that it's not just hardcore tech experts It is, you know, people who have an understanding of the adversary. It is people who actually can translate complex technical topics into plain speak so that more people beyond the security team can understand what's happening. I think all of those are essential elements as well. And then a small, but, you know, it doesn't have to be a huge portfolio of security products or tools. or capabilities. But, you know, knowing how those capabilities map to your protecting most significant or important assets, I think is really important.

Thanks for that. Those are some really good tips. Carol, did you have a question you would like to share, ask Jen? Carol, you're on mute.

Oh, she's on mute.

I was trying so hard to be quiet. Yes. When it comes to fraud, I think small manufacturers who maybe have pivoted towards running their own e-commerce on their websites or maybe through an e-commerce provider, they might not have the resources to do vendor and purchasing background checks. What kind of services or what is Mastercard doing to help the SMEs navigate that to prevent being victims of credit card fraud?

Mastercard has a suite of products, and I'd like to say we're a part of what's called the Global Cyber Alliance, which offers technology and security products to, to small businesses for free or often very reduced costs in order to enhance the protections around small businesses because of course they're critical to our economy and customer base as well. And having insecure vendors as a part of our network, you know, doesn't benefit anyone. So the idea that through both— this is, this also has some government involvement, you know, these offerings I think are really important to build that, you know, again, that small inventory of capabilities that, look, you know, if they get you to 80 to 90%, that's, I think, you know, that's really important. And I think those products and the idea that we're committed to doing so in a free way is, you know, is part of our commitment with many others, I should say. Microsoft is a part of this. Workday, you know, all of the things that— I mean, Workday is a, you know, is an enterprise management tool. That has some incredible vulnerabilities as well. So all of our commitment to do this, I think, is, you know, just part of our commitment to the global economy and infrastructure.

Can I ask a follow-up on the resources that you're offering? Do you have any awareness programs or aware cyber awareness resources for SMEs?

Cyber awareness resources. Um, yes, we do. Um, and, you know, again, we partner with, um, with many leaders in this space. Um, I guess in this case, I would highlight, um, some of the work that we're doing right now with the critical, um, the the Cybersecurity Infrastructure— Cyber Infrastructure Security Agency, CISA, and promoting this widespread awareness of current threats, vulnerabilities, some advice on like the release of a vulnerability and patch, how quickly that has to be done, and now increasingly more real-time. The CISA's Shields Up website is designed for actionable information for small and large companies, for company leadership, for board oversight. And I think that's a really helpful kind of centralized piece. And we are a part of that as even as a private company and also fully aligned with the— through the Financial Services Sector Coordination Council.

That's great. Thanks for sharing that.

And yeah, and we host events on these as well, many virtual obviously for the last 2 years. And I'll just take a note to, you know, Carol, since you have this extensive network, I'll try to share some of those so that you can spread it more widely across this network.

Thanks very much. We'll make sure they're shared in the comments following the our live event today.

Okay, great. Well, thanks.

So, so getting back to that, I like that the— so it's the, you know, globalcyberalliance.org, um, and the CISA will— if you just Google, um, CISA Shields Up, uh, those will get— those will take you straight there as well.

Thanks, Jen. So I kind of wanted to go back because I, I, um, I was fascinated by Mastercard's approach. You know, I, it's a, it's a, in fact, I was listening to something and I, I came across this thing you guys call a Fusion Center. And you started talking about the team of teams, that 26 different teams are part of this. Can you talk more about that? That's, that's fascinating to me.

Well, of course, as soon as I walked into the Fusion Center, I immediately felt at home because you would recognize that it was modeled after, you know, in the military, we had the command center. And it was the hub of activity where intelligence and operations and planning and execution and, you know, all of that coordination was happening and shared situational awareness for, you know, in your command and control hub. So the fusion centers were actually built off of also the security operations centers. So this idea that including intelligence, you know, and understanding what's happening in the ecosystem could better inform our security efforts as well as the business and business risks and be proactive in understanding that, of course we would want to do that. And so it's been wildly successful in a way that of course we would recognize from the military side, but on the business side now, certainly a best practice. And You know, it started with a small group who actually came from— the first fusion center lead came from Delta Force, actually. And, you know, he had set these— the Joint Special Operations Command Center headquarters up in combat zones. And so he started this for Mastercard as well. But you see many of not just financial services companies, but now other businesses modeling this. Because of the importance of staying ahead of trends. And even things that are happening globally can affect you disproportionately domestically. So I'm really proud of it. And having sat in the Fusion Center updates this week on the current crisis, it felt familiar. But I was also reassured that this was the disciplined approach to managing operations.

Well, that's amazing. It is sort of mind-boggling, but understandably appropriate when you think about such a large company and such an important, you know, what network security is in terms of importance to Mastercard. So that's pretty good. And I was also fascinated to hear about a thing called the Cyber Range, you know, where you can actually go and try to break your network. What do you got? Can you talk about that as well?

I can, and I would love to, 'cause the cyber range is also, you know, something that we would recognize from the military, but using the range as a way of testing some of your security capabilities in a protected environment and also emulating adversary tactics to ensure that your defenses are, you know, deliver on how you design them. They also allow you to practice in a, you know, in a, in a very safe way. Um, so these virtual ranges, um, yeah, we, um, you know, we, we also use them to develop individual, um, uh, capabilities. You know, as a, as a, um, security monitoring and response, um, analyst, I want to be able to see what the, you know, what, what a, an attack or a penetration of our network might look like, so I can do so in that range environment and I can practice. You know, did I see it? Were my controls effective? Um, and then I can try it again and try it again, um, for different scenarios and until, you know, I— it's just good practice. So we, um, we use it for capture the flag events. Um, we host, uh, students with it. We host, um, fellow, you know, um, industry counterparts for it. Uh, and it's been hugely beneficial I think that we can align it to some of our most significant security risks is also a way of demonstrating to our customers and to our regulators that we have done due diligence to ensure that we're protecting, you know, their transaction data, their personal information, and things like that. So of course we would want to practice, and things like the range allow us to do that.

Yeah, that's fascinating. I guess, you know, I mean, it sounds like it's intuitive, but I guess until you really kind of think about it and understand, you know, your goals there and what you're trying to accomplish, it's, it, it's again, it's quite fascinating.

Yeah, well, it's funny, it's— we'd appreciate the range actually looks like a room with a bunch of servers and keyboards. So it's kind of like ranges in virtual space. Yes, you know.

Yeah, I guess it's kind of like a flight simulator, you know, you kind of— it just gives you a chance to get out there and train and learn and practice without the consequences of doing something crazy live.

So yeah, and you know, it's modeled on the government side too. Certainly Cyber Command offers the persistent cyber training environment, so you can use it for individual training, for small group training or unit training, and you can use it for large-scale exercises. So I love that, you know, both business and governments are kind of using this best practice.

Is there— so in this, I know we talked about the government, but in the civilian business community. Are there companies that have cyber ranges to train cyber professionals like that, that are, that, you know, or do you guys do that at MasterCard? How, if I'm a cyber professional, and I want to hone my skills, where do I go?

We do offer training, again, for students or industry counterparts, we offer, we promote, like capture the flag events, But I would also say this is a huge growth industry as well. And there are many small vendors that offer range environments to do just this. Some of them have come from the Army or from Cyber Command because they did this on the government side and realized the benefit and potential on the business side. So there are certainly a lot of vendors in this space now so that you don't have to take on the capital expense of setting this up or even, you know, People who do this are in pretty heavy demand. But instead leverage, you know, just get started and leverage what the small, you know, intersection of what you need from one of these vendors. Really a great— you don't have to set up your own range because that might be overwhelming to many, both from a technical perspective as well as expense.

Yeah, thank you. You know, there's one other element that I, that I picked up on at Mastercard, and it's the forensics lab. You know, do you use that all the time when there's a potential breach, or do you— or how do you use that to really make sure that your, your security is solid?

We do use it all the time. And, you know, if I share the, the Girls4Tech video with you to distribute across this network, there's actually a small portion in which we highlight one of our cyber forensic analysts and actually show you part of the lab. But I think it speaks to also our commitment to understand one of our greatest threats, which is insider threats, which is, you know, those who work inside or have access, privileged access to information, to data. And, you know, if they've already overcome that access barrier and they're inside, How can we analyze and recognize unusual or anomalous behavior and then understand what's happening? Is it because this individual, you know, is it from an individual worker? Is it intent? Is it— in many cases, it's actually, you know, we find that you would recognize like social engineering aspects. And so someone imitating one of your employees.

Mm-hmm.

if they've gained access. And so starting being able to recognize that, oh, wait a second, this person is not acting like they normally do on this network and triggering that. So that forensics lab really helps us understand the human factor, the technical factor, and then reverse engineer that to ensure that we've designed security controls to prevent that in the future.

Well, that's fascinating. The complexity of this approach is just, I guess it's mind-boggling for me because I'm not, I don't work in this area, but I really appreciate the breadth of what Mastercard is doing in terms of cybersecurity.

Yeah, and I think one other intersection for businesses is the protection of intellectual property. And, you know, the idea that, you know, there are of course data loss prevention tools and things like that. But just even, you know, being able to print documents at home and/or recognizing unusual activity for data exfiltration, you know, please no USB device, external devices. So recognizing that anomalous activity for the protection of IP is also, I think, one aspect that's, you know, particularly useful to many businesses.

Yeah, no, thank you. In fact, that makes me think more about, you know, we have a lot of our audience will typically be mid to small, midsize to small manufacturers, and they can't afford to do the breadth of what someone like Mastercard does. Talk about maybe the 2 or 3 critical things that a small to midsize manufacturer needs to be sensitive to, to really have a good cybersecurity program.

The first is perimeter defense. You know, you want your, your network to be fully defined and understand who has access within your network and how they gain access. Many of us have been challenged over these past 2 years because now we work remotely. We're not sitting in an office on-premise with our corporate network. And so a solid understanding of the network and what that means is the first thing. The second thing is, I think, a prioritized list of what, you know, of your most valuable or significant data or information that you wanna protect. I think, you know, we can't protect everything all the time from every threat. And so it is logical that, you know, you would want to make decisions around the importance of that. And so understanding what has to be protected And you can have tiered models, I think, is the second point. And the third point is having someone on point, a trusted entity to lead the security and speak truth and an understanding of what's happening and also conveying the risks, I think, is important as well.

Well, thank you for that. And that's really key because I think And the other part that's interesting, I think small and mid-sized manufacturers, you know, a lot of times they wonder, well, should I even care about this? And what I mean by that is, you know, who's going to— who's going to— who's going to get into my business? Who cares about my business? You know, and I think it's— so that's really a tough question for a lot of them is where they put their money and, you know, how much they actually spend on cybersecurity. What are your thoughts about that?

Yeah. And look, I'm well aware that, you know, again, the perfect security posture is probably unachievable and unaffordable, which is why, you know, you have to really make some key decisions around what you want to protect, absolutely protect at all costs, versus where, you know, a monitoring solution can be effectively employed. I think also, as we started out the discussion, you know, an understanding of critical suppliers. And so I think increasingly many small manufacturing firms or small vendors they now, in providing services or support to a larger vendor, actually have to undergo a great deal of scrutiny, what we would call vendor third-party and fourth-party due diligence, to ensure that they meet fundamental security standards in order to be able to provide services and support. So I think the value proposition there is because your service offering may introduce vulnerabilities into a larger ecosystem, Assuring against that you meet fundamental protections so that you can assure those that you're doing business with that your ecosystem is likewise secure is, you know, that is the value proposition.

Yeah.

I don't think you can afford to not offer that any longer because we all know the risks and we've seen how, you know, if the path to a larger target is through a smaller vendor, Thus, you know, you have to be protected even as that smaller vendor. I also think some of those service offerings, though, and those linkages to larger vendors are opportunities to enhance your security posture using the larger firm. You know, because like we, any vendor that we're working with, obviously, you know, we want to help them. We want to welcome them into our ecosystem, and we also want to bring them up to our security standards as well. So, you know, usually the security teams work really, really well. So if you have that security person on point, being able to work, you know, with those you do business with for a shared security awareness and posture, I think that's really important.

Thanks, Jen. I just want to take a quick pause here and mention to our listeners, this is the Industry 4.0 Club. We've been talking for the last half hour with Jen Buckner. Jen is the Senior Vice President for Technology Risk Management for Mastercard, and has been giving us some really wonderful insights into cybersecurity during this period of time.

I would proactively— you know, this is something we touched on in our prep, but perhaps also a good time to bring in other tools, free tools to help you meet some of your cybersecurity obligations, because it's not just a matter of compliance, but it's also a matter of demonstrating that compliance to an increasingly complex landscape of regulatory requirements. You know, many small vendors have to comply with Payment Card Industry Standards, the PCI standards. And if you— even if you are a US business doing business globally, you know, there are some pretty increasingly complex data protection laws and privacy laws being implemented. And so complying with— demonstrating compliance with those, you know, I think is also a a challenge for many small businesses and vendors. So we are one of the founding partners in the Cyber Risk Institute, which offers free a tool called the Profile. It's advocated as financial services, but what it does is it collapses about 2,700 different regulations, um, US and global, into a series of 270 diagnostic statements. And they're kind of, you know, like, for access control, privileged access control, do you do this? And it has kind of a list of how you would evidence it. It's really helpful, right? It's free, it's spreadsheet-based, um, and you don't have to, you know, you don't have to pay attention to all of it. Um, you can certainly pick those areas that are compliance and regulatory, um, importance to you, but we, even we, you know, we have to comply with, you know, a specific country, a region and market. We are a global business. So the idea of this standardization, I assess something once and then I apply it to many different compliance requirements or regulatory obligations, I think is, you know, is one thing that's helpful not only to us, but really across all vendors or businesses. And I really like this tool. It's, again, it's spreadsheet-based today. It's increasingly working to be like a TurboTax for regulatory cybersecurity regulations future state, but it's got a lot of promise and it's helping us deliver on what I would call regtech on the regulatory side and standardization on our side.

So our small— so our small to mid-sized manufacturers would benefit from grabbing that tool, it sounds like. And, you know, looking at that, and at least, you know, if I'm the— if I'm the only person focused on cybersecurity at my company, you know, that's a wonderful tool for me to see how am I doing and what I might recommend to my boss about what we need to do to be better at cybersecurity.

Yes. You know, each diagnostic statement by itself is, oh, I can answer this. But, but really, when you start to unpack what has to be a part of that, And I think it allows you to do, you know, like we've done a self-assessment with it, and then we brought in actually a vendor to help us grade ourselves to make sure that we were, you know, seeing everything. So it's actually something that you could bring in a vendor to help you with so that it's not just solely on you, but it's also, you know, I think it also helps focus if you're gonna bring in a vendor to support your security posture. This is one tool that is easily communicable communicated to your security team in technical means, to your compliance team for regulatory requirements, and to company and board leadership because it delivers a, you know, here is how we assess your security posture and risk. And it's free. Did I mention?

I heard it was free.

Yeah.

Great. Carol, do you have a question for Jen?

Yes, a quick comment on the first, on the I think it's a valuable tool. I've heard from small manufacturers who are doing what they can in-house and then trying to manage their budgets when they bring in a vendor. At least somebody internally has set the ball in motion, and if there's any issues down the road, then at least they have a point of contact with the vendor. And I think this tool is really valuable to helping people adopt the controls necessary. So that's really great, and we'll make sure that that's included in our comments. My question goes back, Jen, to the networking and sharing of networks. And also, while people are working at home, there's also the sharing of networks between third and fourth-party vendors as manufacturers are trying to make things easier by digitally hosting documents and CAD and things like that? What do you think they can benefit from, from the resources you have, and what tips would you have for them to ensure their security? For— I'm sorry, can you clarify the tip for third-party, for manufacturers who are sharing their networks with third-party and fourth-party vendors? So this would be supply chain related.

Yeah, so I think, you know, having a clear understanding of what your security due diligence looks like and how third and fourth-party vendor would demonstrate that. You know, it only takes one event to come back and look at the due diligence and go, did we ask that question? Did we have an understanding of how they were achieving, you know, this, this control or this limitation? So, you know, we are in the position of both requiring that of third and fourth-party vendors, but also that same due diligence to our customers. So I think that there are so many best practices out there right now of what does your initial intake on due diligence look like? How do you manage, you know, what are your red lines to go, you have to fix this before you join our network, or, you know, or this is an issue we will, you know, we will do business together, but you have to fix this within this period of time and we will come back and check. And then when you come back to revalidate some of these based on new threats, new capabilities, new information, you really have to have a disciplined third and fourth party due diligence process that is inclusive of security, but I think also applies more broadly to data protection, and the protection of, you know, personal information, things like that. You have to— much like security, I would also advocate, you know, if you can afford to have someone dedicated to this because it is, you know, again, so important. And you— because you're also in a position of having to provide, you know, here is how I maintain— I communicate my posture to others as a vendor.

Mm-hmm.

I think that's also helpful. They're related but should be separate.

Thanks, Jen. I didn't think about that, that the vendors would actually be inquiring to the manufacturers for assurances that their side is also protected. So thanks very much for bringing that up as well.

So, Jen, one of the things that you mentioned earlier in our conversation, which I wanted to come back to, was Girls4Tech. Can you talk a bit about what that is and your involvement with that?

Another reason that I joined Mastercard and I love to, you know, be a part of it, and it's our commitment to grow and develop and mentor, you know, the next generation of cybersecurity experts or, you know, even technology experts. We all know that women are underrepresented in our technology fields, and it starts with some really solid foundations, you know, in math, science, and other technology subjects. So we, we have Girls4Tech programs. They are free educational offerings to K through 12. They are curriculum-based. They have exercises. We also have a pretty robust volunteer program to go out and deliver some of these exercises and, you know, just do classroom work and talk to people about careers. We publish monthly magazines for kids on this. And I think, you know, we have some recent— actually recent Girls4Tech alum, if you will, who have joined as college interns. So, you know, It's not any one thing, it's a series of things. And I think we found that just providing this— look, not every teacher can, you know, be an expert in everything. So here's a ready-made, you know, I just unpack it and it's something that I can deliver to my students at any age and in any classroom environment. I think is, you know, I love it. It's really fun. And some of the games are really challenging. And it also promotes, I think, a bit of diversity of talent that, you know, not everyone has to be in security and technology. You don't necessarily have to code or love computers. That, you know, there are math things, there are robotics things, or there's people who have a great understanding and they can make cartoons to illustrate what's happening. I think we have some, you know, people who really like designing video games. which is actually one of the ways that, you know, we deliver content on the Cyber Range. So it really can appeal to a broad group too. It's not just about developing, you know, students who can code in Python. It's, you know, everyone has a place in security and technology, and how can we help girls in particular, you know, find their way— or make their way, I should say.

How long has Mastercard had this program in place?

I think they've had it for 2 to 3 years. It's definitely grown in the last 2 years. And I think our partnership with Discovery, the Discovery Channel last year in 2021, you know, that was because we partnered with them in order to deliver content. And I think making it as accessible as possible So that the bar to entry is, you know, is just not something that would, would keep people from not wanting to include this in their classroom or their after-school activities. So started as a grassroots effort, you know, by one of the women at Mastercard, but now in our partnership with Discovery Education, it's, you know, expanded its materials, its video content, and certainly Discovery Education has, uh, um, produces some really, really, um, savvy content that appeals to, you know, different age groups.

And if people wanted to find out more about that, where do they— where can they go? Is there a website?

Um, can I share the link with you?

Yeah, please. That would be great. Super. No, that's really important. That sounds like a wonderful program and one that we want to get out to make more and more and more awareness of around the country. So that's super.

Yeah. And, you know, one of my, um, team members on Friday. She is part of the Girls for Tech India. So it was her first time with the program. They're starting it in India. And, you know, she was in the classroom for a couple hours with students. She's a relatively new employee, but she loves it. You know, she loved being a part of it. And I think, you know, it was with some students who were in a Look, everything that we can do with, you know, underrepresented and underprivileged or underserved communities is important. And I think that, you know, this is— coding is equal opportunity. So she loved it. And the idea that it's a part of her job is, you know, is, I think, one way that we look for meaning in our personal and professional lives today.

Yeah, thank you for that. In fact, you know, it leads me to read one last question for you before we begin to wrap up. And that's, you know, what advice do you have for young professionals who want to get into cybersecurity?

I, I would say that we, you know, we are a large tent. And as I, as I said, you know, a diversity of talent is that we welcome and we need everyone, that it's not just people who code. It can be our behavioral specialists. It can be people who understand adversary tactics, techniques, and procedures. It can be engineers. It can be lawyers. Increasingly, I often tell stories about how one of my most important team members was my communications specialist, someone who could tell the story both to external customers or groups of people as well as internally to leadership and in the business. I also would say that while many of us are competing for high-end talent coming right out of college, that we also offer career pivots for mid-career professionals to transition from something that you've been doing, even actually reentering the workforce. If you've stopped to raise a family, that there are so many great programs to get you ready to come into an entry or mid-career level role consistent with your life experience. I think we have a program called the Cyber Talent Initiative, and that has actually delivered on mid-career professionals who have gone back to college or graduate school to get a degree in some technical engineering or cybersecurity field. And what a benefit they are to us because they offer life experience. They've worked as part of teams. They've been managing their family. You know, they have a savvy that some college students, you know, don't just have because they're younger. So I love the idea that we would have these multigenerational and multidiscipline and, you know, teams to bring together. So I think the hardest part is to just get started. If you have an interest, I am sure that there is a program out there to get you up to speed and to get you ready to join a security team.

Thanks for sharing that perspective. Carol, as we begin to wrap up, do you have one last question you'd like to ask Jen? You're on mute.

Can I just answer the question that's in the chat?

Yeah, please.

I wanted to just make a pitch for not just passwords, but multifactor in your work, you know, and multifactor authentication, whether you are working as an employee, but also demanding that from your customers, because that's how you ensure the security of your customer interfaces. And then we all know that we should be doing that for— in our personal lives too. That gets you to, you know, 80, 90%.

Thank you for that. Carol, any last thoughts or questions for, for Jen as we wrap up?

No, that was my question. I was going to pull the question from the audience. My last thoughts, I was— I'm impressed with the programs and the work you're doing at Mastercard, especially the tool that you're offering for SMEs. I think having it free and really encompassing everything that they need is really valuable. Thanks very much.

Jen, would you share a closing comment for our audience before we finish up our time together today?

Well, thanks for the opportunity again. I'm really pleased to It's interesting to come from a career of service, 30 years in the Army. And certainly I didn't stay in the Army to get rich. But that aspect of a commitment to being a part of a team and contributing to a greater good was so important. And when I transitioned to private sector, looking for that same connection, albeit in a little bit of a different way, to a team and making a difference, I am so fortunate to have found that with Mastercard. But I would also, you know, say that I also find security teams to be pretty consistent no matter what the size or scale of the company. That security teams, you know, they are best in crisis. They are so committed to the craft. And I remain, you know, just in awe of some of their commitment, their dedication to this mission to keep not only their business but also, you know, our country safe. And I think that's, you know, one of the appeals to being in cybersecurity today, that it's not just delivering for a bottom line of a company. It's also so important for our national security. I think we all recognize the importance of not just commerce, but, you know, the private sector in protecting what is most dear to our country. So, you know, that's such a, I think, important lesson. And I'm— again, I— perhaps stayed in the Army accidentally for 30 years. Um, and I guess that's— I would come back to my career advice, which is be careful, you know, of your perfectly designed career because you might miss the opportunities that present themselves that you wouldn't have known about before. Remember that when I graduated from West Point in 1990, cyber wasn't a thing, it wasn't an opportunity. Um, and, and here I am today because I was open to those opportunities So I, you know, I wish you all well. And if I can certainly serve as a connector to some of these resources, MasterCard or otherwise, just industry and on the government side, I'm happy to do so. And likewise, I'm happy to not only mentor but also connect with other mentors who might be better fits because we all need a coach.

Jen, thank you so much for taking the time out of your busy schedule to join us. So this has been the Industry 4.0 Club, and this is our weekly fireside chat. We've been fortunate to have with us today Jen Buckner, who is the Senior Vice President for Technology Risk Management at MasterCard. If you like this broadcast, the Industry 4.0 Club does broadcasts weekly. On Mondays, we do Women in Manufacturing. at 11:30 AM Eastern time— I'm sorry, 12:30 PM Eastern time. On Tuesdays, we do the Future of Manufacturing, where we focus on a particular element, a technical element of Industry 4.0. Wednesdays is our weekly fireside chat, and Thursdays we focus on people, process, and culture, and that also is at 12:30 PM Eastern time. So with that, please follow the Industry 4.0 Club. You see the website below as well as connect with us on LinkedIn. And thanks again, Jen, and we'll look forward to future conversations.

Thanks, Mike, Carol, and everyone online.

Thanks.